Elvington CE Primary School City of York Council Internal Audit Report 2016/17

Business Unit: Children’s Services, Education & Skills, Headteacher: L Collier Date Issued: 13/12/16 Status: Final Reference: 15691/001

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction This audit was carried out on Tuesday 28th June and Wednesday 29th June 2016 as part of the Internal Audit plan for Education, Skills and Children’s Services for 2016/17.

Objectives and Scope of the Audit The purpose of this audit was to provide advice to the Governors, Head Teacher and the Authority's Section 151 Officer about the financial management procedures and assurance that internal controls of the school were operating effectively to manage key risks, both financial and otherwise. The audit covered the following areas in accordance with the specification issued on 17th May 2016:

- Governance;
- Financial Management;
- System Reconciliation;
- Petty Cash
- Contracts – Ordering, Purchasing and Authorisation;
- Income;
- Capital and Property;
- Additional School Activity Provision;
- Human Resources;
- Payroll;
- School Meals;
- Pupil Numbers;
- Voluntary Funds Monitoring Arrangements;
- Data Protection and Information Technology;
- Insurance and Risk Management;
- Joint Use Facilities;
- Inventory Records;
- Security; and
- Safeguarding Arrangements.

Key Findings The key findings in the audit related to ensuring all current Governors have a declaration of interests in place, ensuring the schools financial delegations are up to date, evidencing the recording the receipt and opening of quotations, encryption of data storage devices, adoption of a publication scheme and completion of inventory checks. Overall Conclusions An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance.

## 1 Register of Interests

| Issue/Control Weakness | Risk | |------------------------|------| | The register of interests for governors was incomplete. | Members of the Governing Body may be in a position to influence the placing of contracts in which they have a personal interest and the school may be unable to fully account for purchasing decisions in the event of challenge. |

### Findings

The register of governors Interests was reviewed. One current governor had not completed a declaration. The missing declaration related to a governor whose term of office commenced after the annual update of the register was completed.

### Recommendation

The school should ensure that all governors have a current declaration of interest including governors commencing their term of office after annual renewal of the register. Any relevant interest registered should be taken into account to avoid conflicts of interest.

### Agreed Action 1.1

This has been completed.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Headteacher/Chair of Governors/Clerk of Governors | Completed |

## 2 Budget Management Policy

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The review of the budget management policy, financial delegations and terms of reference was incomplete. | The budget management policy, financial delegation and terms of reference may not reflect the school's current requirements |

### Findings

The budget management policy had been partially reviewed at the Staffing, Finance and Premises Committee on 26th April 2016. The policy had not been approved by the full governing body pending update of the financial delegations and schedule of responsibilities. Terms of reference had been passed to the relevant committees for review but had not been approved by the Full Governing body.

### Recommendation

The update of financial delegations and responsibilities should be progressed. Terms of reference should be reviewed and approved by the full governing body on an annual basis. The approved budget management policy to include financial delegations and terms of reference should be signed and dated by the chair to confirm there have been no subsequent amendments.

### Agreed Action 2.1

This has been agreed at Staffing and Finance committee and will also be approved at the next FGB.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------------| | 3 | Headteacher/Chair of Governors/Clerk to Governors | Spring 2017 |

### 3 Contract Review

| Issue/Control Weakness | Risk | |------------------------|------| | The school has compiled a schedule recording current contractual arrangements, costs and contract end dates. This has not as yet been presented to Governors. | Best value may not be obtained from service contracts at the school. |

#### Findings

A contract schedule has recently been put together by the Bursar detailing all ongoing contractual arrangements at the school. Procurement of an IT managed service was being undertaken at the time of the audit. The schedule had not been presented to governors to evidence that the arrangements, including those through CYC services to schools are reviewed at least annually and that procurements are effectively planned where appropriate.

#### Recommendation

The Schedule of contracts now in place should be presented to Governors finance Committee on at least an annual basis to evidence review of contractual arrangements and provide assurance to governors of effective procurement planning.

#### Agreed Action 3.1

To be actioned.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business Manager | Spring 2017 |

## 4 Procurement

| Issue/Control Weakness | Risk | |------------------------|------| | The receipt and opening of quotations is not recorded. | The school may be unable to justify its purchasing decision in the event of challenge. |

### Findings

Recent procurement in excess of £5K was reviewed. The main procurement completed directly by the school was a 9.6K net spend for resurfacing in the playground. Only two quotations could be found. No opening record for quotations had been completed to evidence that quotations had been opened at the same time by two officers.

### Recommendation

A minimum of three quotations must be sought for expenditure in excess of 5k and below 100K. Quotations should be held securely until the notified opening date after which all quotations should be opened together. This should be evidenced on an opening record signed and dated by two officers present at the opening. A sample of quotation opening record has been sent to the School.

### Agreed Action 4.1

Recent procurement for IT has had three quotes. Records are retained.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business Manager | Completed | 5 Income

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The schools schedule of charges had not been updated on an annual basis. | Charges may be insufficient to cover costs to the school. | | Charges to the Elvington Under 5’s group had not been reviewed for a number of years. | |

Findings

The school has a lettings policy and a schedule of charges. There was no evidence that the charges had been reviewed and approved by the Full Governing Body in the last 12 months.

It was also noted that the agreement with the Elvington Under 5’s Group had not been reviewed for a number of years and charges which had originally been set to cover costs to the school had remained the same. A copy of the agreement could not be found at the time of the audit.

Recommendation

The schedule of charges should be reviewed and approved by the Full Governing Body on an annual basis. The agreement and charges to Elvington Under 5’s Group should be reviewed and revised to ensure all costs to the school are covered.

Agreed Action 5.1

To be actioned Spring Term

| Priority | 3 | |----------|---| | Responsible Officer | School Business Manager | | Timescale | Spring 2017 |

### 6 Data Protection & Information Technology

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The school may be holding unencrypted personal data on data storage devices which may be vulnerable to being lost or stolen. | Statutory requirements may be breached. The ICO has powers to levy fines of up to £500,000 for the most serious breaches of the data protection act. |

#### Findings

The school has an approved E Safety Policy which specifies that any personal data held on the hard drives of lap tops or on memory sticks should be held securely and removed as soon as necessary, however Lap tops and memory sticks and other data storage devices are not currently not encrypted. Encryption is advised by the Information Commissioner and guidance is available on the ICO website. It is understood that the school is currently re-letting their ICT contract and encryption is specified within this contract.

#### Recommendation

The school should ensure that all lap tops, memory sticks and other devices which may be used to hold personal data are encrypted.

#### Agreed Action 6.1

Completed. Recorded in Single Central Record. The new IT company have ensured new laptops are encrypted also.

| Priority | 3 | |----------|---| | Responsible Officer | Deputy Headteacher | | Timescale | Completed |

## 7 Publication Scheme

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The school has not adopted the Information Commissioners Model Publication Scheme for Schools and associated Guide to Information. | The school may not be complying fully with the requirements under the Data Protection Act (DPA), Environmental Regulations (EIR) and Freedom of Information Act (FOIA) and statutory requirements may be breached. |

### Findings

Schools are required by the Data Commissioner to adopt the Model Publication Scheme and associated guide to information. This had not as yet been actioned by the school.

### Recommendation

The Information Commissioners Model Publication Scheme should be adopted by the school and approved by the Full Governing Body. This can be obtained from the ICO website and must be adopted in full, unedited and promoted alongside the Guide to Information. The approved Publication Scheme should be made available to parents eg published on the schools website and where possible the information referred to in the schedule made available via the website.

### Agreed Action 7.1

To be actioned

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------------| | 3 | Headteacher/School Business Manager | Summer 2017 | 8 Inventory

| Issue/Control Weakness | Risk | |------------------------|------| | The school's inventory record has not been checked by an officer independent of maintaining the record. | Items which have been lost or misappropriated may not be highlighted and investigated. |

Findings

A recent check of the school's inventory had been completed by the officer responsible for maintaining the inventory record. This check should be completed by an officer independent of maintaining the inventory. A review of the record highlighted that a number of items of furniture and lower value items are recorded which are not required to be subject to full inventory controls (although the school may want to maintain a record of these items). Additionally, items which had been disposed of had not been removed from the record.

Recommendation

It is suggested that the inventory record is reviewed to ensure only appropriate items are subject to full inventory controls. A deminis value for these items should be set at a level to ensure that, at minimum, all items over £200 in value are recorded and checked. However, the school should also consider recording some lower value items if they may be particularly susceptible to loss eg cameras. Items which have been disposed of can be removed from the record but the disposal notice should be retained. The printed inventory showing the items verified at the last check should be signed by the checking officer, who should be independent of the officer maintaining the record. The verified record should be held in school.

Agreed Action 8.1

To be completed.

| Priority | 3 | |----------|---| | Responsible Officer | School Administrator/School Business Manager | | Timescale | Spring 2017 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |-----------------------|-------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.